Challenges in Today's 3G & 4G/LTE Traffic Visibility - Gigamon
←
→
Page content transcription
If your browser does not render page correctly, please read the page content below
F E AT U R E B R I E F
GTP Correlation
Challenges in Today’s 3G & 4G/LTE Traffic Visibility
As data traffic from mobile devices and applications continues to grow
exponentially, mobile carriers have searched for a way to efficiently and
effectively monitor performance and Quality of Experience (QoE) for their
subscribers, as well as identify and monetize new offerings.
However, in order to ensure accurate, cost-effective analytics from
their tools infrastructure, service providers are dependent on two
critical components:
• Ability to correlate traffic flows on a per subscriber basis
• Visibility across all segments of the mobile network
GTP Correlation
GPRS Tunneling Protocol (GTP) is used to carry mobile data within the
core of the Mobile Operator’s network. GTP uses both Control Plane
protocol (GTP-c) and User Plane protocol (GTP-u) to carry subscriber
application traffic from the subscriber device to the internet. Visibility into
a subscriber’s traffic requires the ability to understand the subscriber
attributes and stateful information contained within the GTP-c (v1 and/or
v2) to correlate subscriberspecific GTP-u traffic so that monitoring tools
can achieve an accurate view of the subscriber’s traffic on the network.
Gigamon’s GTP correlation application helps carriers gain access to the
subscriber’s traffic in these GTP tunnels by reliably correlating and
passing all of the identified subscriber’s control and data sessions to
the analytics/monitoring probes and/or billing subsystems to ensure an
accurate view of the subscriber sessions (see Figure 1).
Further, given the rate of increase in the volume of information traversing
through the mobile service provider network, the tools infrastructure
has been unable to scale accordingly, and proliferating tools across the
network to monitor millions of subscribers can be very expensive and cost
prohibitive on both a CAPEX and OPEX basis.
With Gigamon’s GTP correlation application, mobile operators can install
a monitoring policy within the Visibility Fabric™ that will intelligently deliver
subscriber traffic to the specific tools. It does this by correlating the
subscriber specific attributes including the subscriber ID, also known as
the International Mobile Subscriber Identity (IMSI); device ID, also known
as the International Mobile Equipment Identity (IMEI); subscriber endpoint
number, also known as the Mobile Subscriber – Integrated Services
Digital Network (MS-ISDN); mobile core interface (Gn/Gp, S1U/S11,
S5/S8) where the session is carried and other GTP-c related attributes
that are exchanged as part of the control sessions. All subscriber device
user plane traffic is carried within GTP-u tunnels which are identified within
the GTP-c protocol as GTP tunnels, also known as Tunnel Endpoint ID
1
FEATURE BRIEF | GTP CORRELATION
NETWORK TOOLS
Sub A
Sub A Customer
Experience
Sub B Management
(CEM)
4G
Sub C
Sub C
Sub D Flow Mapping® GTP Correlation Application
Performance
3G
Sub n Sub D
Billing
Visibility Fabric
Figure 1: GTP correlation
(TEID). Once the GTP-u TEIDs are known and correlated to GTP Correlation can be combined with other GigaSMART®
the subscriber level attributes, then subscriber traffic can be traffic intelligence applications like Application Filtering
processed in subscriber aware manner. With this capability, Intelligence for example, which enables monitoring tools to
the Visibility Fabric using GTP correlation leverages a Mobile perform more efficiently by eliminating entire sessions of
Subscriber-aware monitoring policy, and can optimize current unwanted traffic. The GTP correlated traffic that is destined
tool infrastructure investments by providing only relevant data to servers hosted in an operators’ infrastructure can also be
to the tool while increasing visibility into subscriber traffic that decrypted by the GigaSMART SSL decryption function for
can help improve QoE and performance. malware analysis or inspection by other security functions.
Gigamon’s GTP correlation application also has the ability to
GTP correlation enables important Subscriber-Aware features ensure that all IP fragments within the subscriber session are
that optimize traffic monitoring: sent to the same tool.
• The first is GTP Subscriber Filtering whereby subscriber When used with FlowVUE, Gigamon’s intelligent scaling of
traffic can be selected and forwarded to monitoring tools active subscribers, carriers can have a representative view
utilizing attributes including subscriber information such of a subscriber’s usage patterns. Armed with these subscriber
as IMSI, IMEI or MSISDN, or GTP session information, such level insights, Gigamon® products can help operators to
as GTP Version or Mobile Core Logical Interface (Gn/Gp, identify roaming subscribers across peered networks through
S1U/S11, and S5/S8) IMSI filtering.
• The second is GTP Load Balancing whereby all GTP
sessions are load balanced to as many as 16 tool ports By gaining a complete activity view of high-value subscribers,
utilizing IMSI based load-balancing criteria carriers can look to:
• The third is Gigamon’s GTP correlated FlowVUE® traffic
scaling application. GTP correlated FlowVUE ensures that • optimize ARPU by improving operational efficiency, which
100% of traffic for a sampled subset of subscribers can be allows the carrier to better compete with their in-market
forwarded to monitoring tools, allowing the traffic to be competitors on an expenses basis
scaled to fit the existing tools. FlowVUE also allows the • ensure business continuity and Quality of Experience
operator to allocate separate (and possibly overlapping) • and identify and monetize new offerings.
samples from a common pool of traffic data to each tool
• Finally, Gigamon’s GTP forward-list feature allows a
defined list of high-value subscribers (up to 500,000) to
be chosen to receive full time monitoring even with GTP
correlated FlowVUE processing enabled
© 2021 Gigamon. All rights reserved. 2FEATURE BRIEF | GTP CORRELATION
GTP Correlation Features • Maximize Quality of Experience and monetize services
• Stateful Filtering Based on Subscriber ID’s (IMSI) – Gain pervasive subscriber-level visibility and empower
– Stateful correlation of GTP-c with GTP-u messages monitoring tools to gauge end-user QoE
– Correlation of subscriber ID with corresponding – Utilize real-time stateful visibility to enable reliable
tunnel ID accounting, billing, and subscription management
– Forward of Subscriber-specific control and user plane • Make the transformation to a Unified Tool Rail possible
sessions to a tool or a group of tools – Cost-efficiently correlate GTP at the Visibility
• Traffic Filtering, Replication, and Distribution Based on: Fabric layer instead of needing a GTP correlation
– GTP TEID and inner-packet parameters including: license for each attached tool, across multiple different
Src/Dst IPv4/v6 Addresses, Protocol, Src/Dst Port, IP tool vendors
Version, TOS, TTL, DSCP, Fragmentation Flags, TCP Flags – Ensure that each tool receives identical GTP correlated
• Support of LTE and 3G Networks including GTPv1 traffic to help decrease the MTTR, and reduce attached
and GTPv2 tools results ambiguities
• Support the use of the APN and QCI attributes as a – Allow the results of all attached tools to be better
criteria for FlowVUE and GTP forward-list features correlated together, improving insights by increasing
allowing traffic to be routed to different tools or discarded accuracy and precision
based on the type of network connection the device – Distribute unique samples to each attached tool based
has requested on the tool’s requirement to study specific traffic and
• Support the allocation of separate samples for each tool the type of network connection requested.
port or tool port group from a common pool of correlated
control and user plane data as part of FlowVUE and GTP Rethinking Operator Infrastructure Monitoring
forward-list features with Subscriber-Aware Visibility
Key Benefits GTP correlation enables user and data plane correlation.
• Optimize the Tools Infrastructure After correlation, both the user and data plane traffic can
– Optimize tools processing by accurately be directly sent to the tools when the primary objective
filtering, replicating, and forwarding monitored is offloading tools from the overhead of GTP correlation.
subscriber sessions Gigamon’s solution goes much further than just tool
– Reliably correlate subscriber sessions (control and data) optimization. It is one of the core building blocks for operators
to increase analytics accuracy looking to build a best-in-class, modern, subscriber-aware
• Pervasive Visibility into Subscriber Traffic visibility platform as shown In Figure 2 below.
– Extend visibility and proactively identify service issues
impacting (and frustrating) subscribers
– Facilitate drilldowns into roaming users across
peer networks
Programmable Interface (API) API
User and data Traffic reduction: Traffic reduction: Subscriber and OSS / BSS
Production network
plane correlation filtering scaling traffic insight optimization
UNI / NNI / SIEM
Security
optimization
APM / NPM / CEM
Tool rail
optimization
GTP Flow Mapping® FlowVUE™ Application Fraud detection Revenue
revenue protection optimization
Corellation Filter Intelligence
New revenue creation Service
operational advantage optimization
Analytics / metrics
Real-time
Big Data
Figure 2: An example of a best-in-class, modern, subscriber-aware visibility platform
© 2021 Gigamon. All rights reserved. 3FEATURE BRIEF | GTP CORRELATION
By combining GTP correlation with other traffic intelligence Pervasive Visibility with a Visibility Platform
capabilities in the Unified Visibility Fabric, operators can gain
deep insights into their networks and both: In this era of Big Data, mobile carriers have searched for a
way to efficiently and effectively monitor performance and
• optimize their per-subscriber monitoring cost QoE for their subscribers, as well as identify and monetize
• and offer new services that increase the Average new offerings. Converging on a single visibility platform that
Revenue Per User (ARPU). not only simplifies and automates network traffic visibility,
but also provides built-in intelligence to address Big Data
This is done with tiered monitoring strategies that separate will shape how mobile carriers choose to monitor and
higher-ARPU subscribers from lower-ARPU subscribers. manage their network to provide better, faster connections
and new services, while increasing operational efficiency and
Such an architecture enables operators to scale their traffic network uptime.
to meet their tools processing throughput. Forwarding
allows all traffic from specific IMSIs to be sent to the tools Legacy approaches to monitoring have offered limited traffic
whereas sampling selects a configurable set of user sessions visibility with limited filtering capabilities, are difficult and costly
for analysis. Both forwarding and sampling are part of the to scale and manage, and often require change orders or
FlowVUE application in the GigaSMART suite of traffic network downtime in order to adapt to the evolving network.
intelligence applications offered by Gigamon for mobile
operators. These capabilities can be used by operators in Gigamon products provide the architecture and intelligence
a variety of ways to implement highly scalable and efficient for mobile operators to create a monitoring infrastructure that
monitoring methodologies. Some examples are: is designed for the new era of Big Data, and deliver pervasive
visibility, awareness, and control from the converged edge to
• Prevent entire application sessions corresponding to the cloud. Sitting between the IT infrastructure and the tools
voluminous Over-The-Top (OTT) traffic such as YouTube, that need the access to data, the Visibility Fabric provides a
NetFlix and other video sites from reaching the tools, holistic approach to traffic visibility that includes:
eliminating expensive and unnecessary upgrades to the
tooling infrastructure Architecture Advantages: The GigaVUE® family of fabric
• Decrypt SSL traffic destined to servers hosted by nodes offers the volume, port-density, and scale needed
the operator and feed them to a security tool for to connect the right analytical tools to the appropriate large
malware inspection or bonded pipes. Tool trials are streamlined, new tools can
• Send only a sample of non-premium sessions to the easily be added or removed, and uptime is protected while
monitoring tools for analysis downtime is prevented with a solution that is outside the
• Send different (possibly overlapping) samples to different production network and provides pervasive visibility.
monitoring tools
• Sample a set of sessions to analyze the quality of service Feature Advantages: Advanced filtering, packet manipulation
at a particular cell site and session-aware traffic identification reduce the amount
• Send traffic to tools based on requested network of data arriving at each tool while ensuring that the data is
connection, e.g. IMS for VoLTE by using APN and QCI as formatted precisely for the tool’s consumption. Each tool is
seletion criteria optimized by not needing to parse the incoming stream or
waste processor cycles on non-relevant data so it can focus on
the more important task of data analysis.
GigaSMART Applications: Traffic intelligence and
management applications provide effective monitoring of
Big Data through the logical reduction of traffic so that it is
more suitable to connect to an existing tool at 1Gb or 10Gb.
Gigamon’s GTP correlation enables visibility at the subscriber/
session level in order to maximize QoE and monetize services.
The FlowVUE application intelligently manages Big Data traffic
through active subscriber-aware flow sampling while keeping
data flows intact.
© 2021 Gigamon. All rights reserved. 4FEATURE BRIEF | GTP CORRELATION
About Gigamon
Gigamon provides active visibility into physical and virtual
network traffic, enabling stronger security and superior
performance. Gigamon’s Visibility Fabric™ and GigaSECURE®,
the industry’s first Security Delivery Platform, deliver
advanced intelligence so that security, network, and
application performance management solutions in enterprise,
government, and service provider networks operate more
efficiently. As data volumes and network speeds grow and
threats become more sophisticated, tools are increasingly
overburdened. One hundred percent visibility is imperative.
Gigamon is installed in more than three-quarters of the
Fortune 100, more than half of the Fortune 500, and seven of
the 10 largest service providers.
For more information about the Unified Visibility Fabric visit:
www.gigamon.com.
© 2018-2021 Gigamon. All rights reserved. Gigamon and the Gigamon logo are trademarks of Gigamon in the United States and/or other countries. Gigamon trademarks can be found at
www.gigamon.com/legal-trademarks. All other trademarks are the trademarks of their respective owners. Gigamon reserves the right to change, modify, transfer, or otherwise revise this
publication without notice.
Worldwide Headquarters
3300 Olcott Street, Santa Clara, CA 95054 USA
+1 (408) 831-4000 | www.gigamon.com 08.21_07You can also read
